@homeflare/alchemy 0.29.0 → 0.30.0

package/dist/google-workspace/domain-alias.d.ts

@@ -0,0 +1,74 @@
+/**
+ * `GoogleWorkspace.DomainAlias` — one secondary-domain alias on the Workspace account
+ * (`admin/directory/v1/customer/{customer}/domainaliases`).
+ *
+ * ⛔ NO `update` OPERATION EXISTS. The Directory API ships `get`/`insert`/`delete`/`list` for
+ *   domain aliases and nothing else — measured against `admin_directory_v1.ts`: there is no
+ *   `patchDomainAliases` or `updateDomainAliases`. `spec.update` is intentionally absent, so
+ *   `resource.ts`'s `diff` reports `replace` for any drift rather than an unsendable PATCH — the
+ *   same fallback NetBox's `netboxOperations` and Forgejo's `forgejoOperations` give a spec with
+ *   no `update`.
+ *
+ * ★ `domainAliasName` IS THE WHOLE IDENTITY. `parentDomainName` only matters at create time —
+ *   Google refuses reparenting an alias in place, so a declared `parentDomainName` that no longer
+ *   matches the live row is exactly the identity change `replace` exists for.
+ *
+ * ⚠️ THE HOUSE'S CLOUDFLARE ZONES (`homeflare.dev`, `aimto.app`, `schenanigans.com`, `taslabs.net`
+ *   — `site/live.site.json` in homeflare-landscape) are DNS zones, not Workspace domains by
+ *   themselves; a zone only becomes a valid `parentDomainName` once it is added and verified as a
+ *   primary or secondary domain in the Workspace admin console. This family does not verify a
+ *   domain — Google's verification is a TXT/CNAME challenge outside the Directory API's write
+ *   surface — so `create` will fail with `BadRequest` against an unverified domain, which is
+ *   correct: nothing here should silently paper over a step the account owner has to do by hand.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import * as directory from '@distilled.cloud/google-workspace/unstable/admin_directory_v1';
+import * as Effect from 'effect/Effect';
+import type { GoogleWorkspaceRequirements, GoogleWorkspaceSpec } from './resource.ts';
+export interface DomainAliasProps {
+    /** The unique id for the Workspace account, or `my_customer` for the caller's own account. */
+    customer?: string;
+    /** The alias domain name — primary key for locate. */
+    domainAliasName: string;
+    /** The primary or secondary domain this alias resolves to. Immutable — a change replaces. */
+    parentDomainName: string;
+}
+export interface DomainAliasAttributes {
+    customer: string;
+    domainAliasName: string;
+    parentDomainName: string;
+    /** Read-only. */
+    verified: boolean;
+    /** Read-only, ISO-ish epoch-ms string as Google returns it. */
+    creationTime: string;
+}
+export interface GoogleWorkspaceDomainAlias extends Resource<'GoogleWorkspace.DomainAlias', DomainAliasProps, DomainAliasAttributes, never, GoogleWorkspaceRequirements> {
+}
+export declare const GoogleWorkspaceDomainAlias: import("alchemy").ResourceClass<GoogleWorkspaceDomainAlias>;
+/** ★ EXPORTED for direct testing — see domain-alias.test.ts. */
+export declare const spec: GoogleWorkspaceSpec<DomainAliasProps, directory.DomainAlias, DomainAliasAttributes, directory.GetDomainAliasesError | directory.InsertDomainAliasesError | directory.DeleteDomainAliasesError>;
+export declare const handlers: {
+    list: () => Effect.Effect<never[], never, never>;
+    read: ({ olds }: {
+        olds: DomainAliasProps;
+    }) => Effect.Effect<DomainAliasAttributes | undefined, import("@distilled.cloud/caddy").BadGateway | directory.BadRequest | directory.Conflict | directory.Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("@distilled.cloud/google-workspace/Errors").GoogleWorkspaceParseError | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | directory.NotFound | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/google-workspace/Errors").UnknownGoogleWorkspaceError, import("effect/unstable/http/HttpClient").HttpClient>;
+    diff: ({ news, output }: {
+        news: import("alchemy").Input<DomainAliasProps>;
+        output: DomainAliasAttributes | undefined;
+    }) => Effect.Effect<{
+        readonly action: 'update';
+    } | {
+        readonly action: 'noop';
+    } | {
+        readonly action: 'replace';
+    } | undefined, import("@distilled.cloud/caddy").BadGateway | directory.BadRequest | directory.Conflict | directory.Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("@distilled.cloud/google-workspace/Errors").GoogleWorkspaceParseError | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | directory.NotFound | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/google-workspace/Errors").UnknownGoogleWorkspaceError, import("effect/unstable/http/HttpClient").HttpClient>;
+    reconcile: ({ news }: {
+        news: DomainAliasProps;
+    }) => Effect.Effect<DomainAliasAttributes, import("@distilled.cloud/caddy").BadGateway | directory.BadRequest | directory.Conflict | directory.Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("@distilled.cloud/google-workspace/Errors").GoogleWorkspaceParseError | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | directory.NotFound | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/google-workspace/Errors").UnknownGoogleWorkspaceError, import("effect/unstable/http/HttpClient").HttpClient>;
+    delete: ({ olds }: {
+        olds: DomainAliasProps;
+    }) => Effect.Effect<void, import("@distilled.cloud/caddy").BadGateway | directory.BadRequest | directory.Conflict | directory.Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("@distilled.cloud/google-workspace/Errors").GoogleWorkspaceParseError | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | directory.NotFound | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/google-workspace/Errors").UnknownGoogleWorkspaceError, import("effect/unstable/http/HttpClient").HttpClient>;
+};
+export declare const GoogleWorkspaceDomainAliasProvider: () => import("effect/Layer").Layer<Provider.Provider<GoogleWorkspaceDomainAlias>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=domain-alias.d.ts.map

package/dist/google-workspace/domain-alias.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-alias.d.ts","sourceRoot":"","sources":["../../src/google-workspace/domain-alias.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,SAAS,MAAM,+DAA+D,CAAC;AAC3F,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAItF,MAAM,WAAW,gBAAgB;IAC/B,8FAA8F;IAC9F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,eAAe,EAAE,MAAM,CAAC;IACxB,6FAA6F;IAC7F,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,+DAA+D;IAC/D,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,0BAA2B,SAAQ,QAAQ,CAC1D,6BAA6B,EAC7B,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,EACL,2BAA2B,CAC5B;CAAG;AAEJ,eAAO,MAAM,0BAA0B,6DAGtC,CAAC;AAoBF,gEAAgE;AAChE,eAAO,MAAM,IAAI,EAAE,mBAAmB,CACpC,gBAAgB,EAChB,SAAS,CAAC,WAAW,EACrB,qBAAqB,EACnB,SAAS,CAAC,qBAAqB,GAC/B,SAAS,CAAC,wBAAwB,GAClC,SAAS,CAAC,wBAAwB,CAmBrC,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;CAAgC,CAAC;AAEtD,eAAO,MAAM,kCAAkC,gJAI5C,CAAC"}

package/dist/google-workspace/fake-google-workspace.d.ts

@@ -0,0 +1,41 @@
+/**
+ * A minimal in-memory Directory API for this family's tests — an in-memory `fetch` handed to
+ * Effect's real `FetchHttpClient` through its `Fetch` reference, mirroring
+ * `../netbox/fake-netbox.ts` and `../forgejo/fake-forgejo.ts`. Tests exercise distilled's REAL
+ * path assembly, JSON encode/decode and status→typed-error matching (`404` → `NotFound`, `403` →
+ * `Forbidden`, …) — nothing about that matching is re-implemented here, only the wire responses a
+ * scenario needs.
+ *
+ * ⛔ TEST-ONLY, AND NO NETWORK. The token is a placeholder that is never a real bearer token, and
+ *   no request this fake answers ever leaves the process.
+ */
+import { type Credentials } from '@distilled.cloud/google-workspace/Credentials';
+import * as Layer from 'effect/Layer';
+export declare const FAKE_TOKEN = "placeholder-google-workspace-token";
+export type Seen = {
+    readonly method: string;
+    readonly path: string;
+};
+/** Google's own `{ error: { code, message, status } }` failure envelope — matching protocol.ts. */
+export declare const fakeFailure: (status: number, message: string, googleStatus: string) => Response;
+/**
+ * `route` decides every response; this wrapper only records what was sent and adapts to
+ * `globalThis.fetch`'s signature. A test that expects no request at all asserts `seen` is empty.
+ */
+export declare const fakeGoogleWorkspace: (route: (method: string, url: URL) => Response) => {
+    fetch: typeof fetch;
+    seen: Seen[];
+};
+/**
+ * distilled Credentials + the real FetchHttpClient over the fake — `GoogleWorkspaceOpContext`,
+ * what every resource file's exported `spec.fetchLive` needs.
+ *
+ * ⚠️ NOT PAIRED WITH `handlers` (each resource file's `googleWorkspaceHandlers(spec)` export).
+ *   `handlers` bakes in `CredentialsFromEnv`, which resolves `GOOGLE_ACCESS_TOKEN` through
+ *   Effect's `Config` — whose default provider snapshots `process.env` once and never re-reads it
+ *   (measured in the forgejo migration, kit PR 180). So a test cannot point `handlers` at a fake
+ *   server; it calls `spec.fetchLive`/`spec.attributes` directly instead, with this explicit
+ *   layer, exercising exactly the same production code without that env seam.
+ */
+export declare const fakeGoogleWorkspaceLayer: (fetchFn: typeof globalThis.fetch, creds?: Layer.Layer<Credentials>) => Layer.Layer<Credentials | import("effect/unstable/http/HttpClient").HttpClient, never, never>;
+//# sourceMappingURL=fake-google-workspace.d.ts.map

package/dist/google-workspace/fake-google-workspace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-google-workspace.d.ts","sourceRoot":"","sources":["../../src/google-workspace/fake-google-workspace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,KAAK,WAAW,EAAmB,MAAM,+CAA+C,CAAC;AAClG,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAGtC,eAAO,MAAM,UAAU,uCAAuC,CAAC;AAE/D,MAAM,MAAM,IAAI,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtE,mGAAmG;AACnG,eAAO,MAAM,WAAW,WAAY,MAAM,WAAW,MAAM,gBAAgB,MAAM,aACM,CAAC;AAExF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,UAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,QAAQ;;;CAUhF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,YAC1B,OAAO,UAAU,CAAC,KAAK,UACzB,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,kGAC+D,CAAC"}

package/dist/google-workspace/group-member.d.ts

@@ -0,0 +1,73 @@
+/**
+ * `GoogleWorkspace.GroupMember` — one user or group's membership in one Directory group.
+ *
+ * ★ WHY THIS DOES NOT MODEL A `GoogleWorkspace.User`. `email` here identifies whoever the group
+ *   member is (a user's primary email, or another group's), the same way Forgejo's
+ *   `TeamMember.username` (team-member.ts) never creates the account it references. The Directory
+ *   API needs no user resource to exist in this family for a membership to be declared — see
+ *   group.ts's own note on why users are out of scope.
+ *
+ * ⚠️ UNLIKE `Forgejo.TeamMember`, A MEMBERSHIP HERE IS NOT EXISTENCE-ONLY. `role`
+ *   (`OWNER`/`MANAGER`/`MEMBER`) and `deliverySettings` (`ALL_MAIL`/`DIGEST`/`DAILY`/`NONE`/
+ *   `DISABLED`) are both mutable in place via `patchMembers` — so this spec declares `update`,
+ *   not `upsert`, the same shape `group.ts`/`domain-alias.ts` use.
+ *
+ * ⛔ GROUP CYCLES ARE THE VENDOR'S TO REFUSE, NOT THIS FAMILY'S. `insertMembers`/`patchMembers`
+ *   surface a cycle as `BadRequest`, which this spec's error union already carries un-narrowed —
+ *   nothing here guesses at "member is itself an ancestor group".
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import * as directory from '@distilled.cloud/google-workspace/unstable/admin_directory_v1';
+import * as Effect from 'effect/Effect';
+import type { GoogleWorkspaceRequirements, GoogleWorkspaceSpec } from './resource.ts';
+export type MemberRole = 'OWNER' | 'MANAGER' | 'MEMBER';
+export type DeliverySettings = 'ALL_MAIL' | 'DIGEST' | 'DAILY' | 'NONE' | 'DISABLED';
+export interface GroupMemberProps {
+    /** The group's email, alias or id — same key `Group.email` declares. */
+    group: string;
+    /** The member's email (a user or another group). Primary key alongside `group`. */
+    email: string;
+    /** @default 'MEMBER' */
+    role?: MemberRole;
+    /** @default 'ALL_MAIL' */
+    deliverySettings?: DeliverySettings;
+}
+export interface GroupMemberAttributes {
+    group: string;
+    email: string;
+    memberId: string;
+    role: string;
+    deliverySettings: string;
+    /** Read-only — `ACTIVE` for a normal member, `PENDING` while an invite is outstanding. */
+    status: string;
+}
+export interface GoogleWorkspaceGroupMember extends Resource<'GoogleWorkspace.GroupMember', GroupMemberProps, GroupMemberAttributes, never, GoogleWorkspaceRequirements> {
+}
+export declare const GoogleWorkspaceGroupMember: import("alchemy").ResourceClass<GoogleWorkspaceGroupMember>;
+/** ★ EXPORTED for direct testing — see group-member.test.ts. */
+export declare const spec: GoogleWorkspaceSpec<GroupMemberProps, directory.Member, GroupMemberAttributes, directory.GetMembersError | directory.InsertMembersError | directory.PatchMembersError | directory.DeleteMembersError>;
+export declare const handlers: {
+    list: () => Effect.Effect<never[], never, never>;
+    read: ({ olds }: {
+        olds: GroupMemberProps;
+    }) => Effect.Effect<GroupMemberAttributes | undefined, import("@distilled.cloud/caddy").BadGateway | directory.BadRequest | directory.Conflict | directory.Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("@distilled.cloud/google-workspace/Errors").GoogleWorkspaceParseError | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | directory.NotFound | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/google-workspace/Errors").UnknownGoogleWorkspaceError, import("effect/unstable/http/HttpClient").HttpClient>;
+    diff: ({ news, output }: {
+        news: import("alchemy").Input<GroupMemberProps>;
+        output: GroupMemberAttributes | undefined;
+    }) => Effect.Effect<{
+        readonly action: 'update';
+    } | {
+        readonly action: 'noop';
+    } | {
+        readonly action: 'replace';
+    } | undefined, import("@distilled.cloud/caddy").BadGateway | directory.BadRequest | directory.Conflict | directory.Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("@distilled.cloud/google-workspace/Errors").GoogleWorkspaceParseError | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | directory.NotFound | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/google-workspace/Errors").UnknownGoogleWorkspaceError, import("effect/unstable/http/HttpClient").HttpClient>;
+    reconcile: ({ news }: {
+        news: GroupMemberProps;
+    }) => Effect.Effect<GroupMemberAttributes, import("@distilled.cloud/caddy").BadGateway | directory.BadRequest | directory.Conflict | directory.Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("@distilled.cloud/google-workspace/Errors").GoogleWorkspaceParseError | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | directory.NotFound | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/google-workspace/Errors").UnknownGoogleWorkspaceError, import("effect/unstable/http/HttpClient").HttpClient>;
+    delete: ({ olds }: {
+        olds: GroupMemberProps;
+    }) => Effect.Effect<void, import("@distilled.cloud/caddy").BadGateway | directory.BadRequest | directory.Conflict | directory.Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("@distilled.cloud/google-workspace/Errors").GoogleWorkspaceParseError | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | directory.NotFound | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/google-workspace/Errors").UnknownGoogleWorkspaceError, import("effect/unstable/http/HttpClient").HttpClient>;
+};
+export declare const GoogleWorkspaceGroupMemberProvider: () => import("effect/Layer").Layer<Provider.Provider<GoogleWorkspaceGroupMember>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=group-member.d.ts.map

package/dist/google-workspace/group-member.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"group-member.d.ts","sourceRoot":"","sources":["../../src/google-workspace/group-member.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,SAAS,MAAM,+DAA+D,CAAC;AAC3F,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAItF,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,CAAC;AACxD,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,UAAU,CAAC;AAErF,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,KAAK,EAAE,MAAM,CAAC;IACd,wBAAwB;IACxB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,0BAA0B;IAC1B,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CACrC;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,0FAA0F;IAC1F,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,0BAA2B,SAAQ,QAAQ,CAC1D,6BAA6B,EAC7B,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,EACL,2BAA2B,CAC5B;CAAG;AAEJ,eAAO,MAAM,0BAA0B,6DAEtC,CAAC;AAqBF,gEAAgE;AAChE,eAAO,MAAM,IAAI,EAAE,mBAAmB,CACpC,gBAAgB,EAChB,SAAS,CAAC,MAAM,EAChB,qBAAqB,EACnB,SAAS,CAAC,eAAe,GACzB,SAAS,CAAC,kBAAkB,GAC5B,SAAS,CAAC,iBAAiB,GAC3B,SAAS,CAAC,kBAAkB,CA4B/B,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;CAAgC,CAAC;AAEtD,eAAO,MAAM,kCAAkC,gJAI5C,CAAC"}

package/dist/google-workspace/group.d.ts

@@ -0,0 +1,87 @@
+/**
+ * `GoogleWorkspace.Group` — one Admin SDK Directory group (`admin/directory/v1/groups`).
+ *
+ * ★ WHY A GROUP IS THE FIRST OBJECT CLASS, AND NOT A USER. The estate's own Cloudflare Access
+ *   policies already reference Workspace groups by name ("Schenanigans - Admin", "Schenanigans -
+ *   Google" — `docs/zero-trust-access-applications.md` in homeflare-landscape) as the Google IdP
+ *   groups an Access rule allows. A group is also the one Directory object with no foreign-key
+ *   prerequisite: `email` is the whole identity, the same reasoning `netbox/prefix.ts` gives for
+ *   starting with `Prefix` over `Device`.
+ *
+ * ⛔ USERS ARE OUT OF SCOPE FOR THIS FAMILY. `insertUsers`/`patchUsers`/`updateUsers` all accept a
+ *   `password` field on the wire `User` schema — modelling `GoogleWorkspace.User` here would put a
+ *   credential-shaped field one keystroke away from becoming a prop, and Alchemy persists props
+ *   unencrypted (S25). No stack in this estate declares a Workspace user today (measured
+ *   2026-09-24 — see docs/upstream-conformance.md), so there is no house need forcing the
+ *   question. `GroupMember` (group-member.ts) references a user by email without ever creating,
+ *   reading or storing one.
+ *
+ * ★ ADOPT-FRIENDLY BY CONSTRUCTION. `groupKey` accepts an email, alias or id; this family always
+ *   uses `email` so `fetchLive` binds the live group by the same key a human would type. An
+ *   instance that already has `admin@schenanigans.com`'s "Schenanigans - Admin" group is BOUND,
+ *   never duplicated, and `attributes` maps the full live row — the exact-as-live half of
+ *   `adopt(true)` (resource.ts's own note).
+ *
+ * ⛔ THIS RESOURCE DOES NOT DELETE BY DEFAULT. `defaultRemovalPolicy: 'retain'` — removing a group
+ *   an Access policy still names would break sign-in for everyone that rule allows. `delete` stays
+ *   fully implemented; a caller opts in with `.pipe(RemovalPolicy.destroy())`.
+ *
+ * ⛔ NO CREDENTIAL IS A PROP. `GOOGLE_ACCESS_TOKEN` is read from the environment at call time,
+ *   through `@distilled.cloud/google-workspace`'s `CredentialsFromEnv` (resource.ts) — see
+ *   credentials.ts for where that token comes from.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import * as directory from '@distilled.cloud/google-workspace/unstable/admin_directory_v1';
+import * as Effect from 'effect/Effect';
+import type { GoogleWorkspaceRequirements, GoogleWorkspaceSpec } from './resource.ts';
+export interface GroupProps {
+    /** The group's email address — the primary key for locate, create and update alike. */
+    email: string;
+    /** Display name. @default the local part of `email` */
+    name?: string;
+    /** Free text, up to 4,096 characters per the Directory API. */
+    description?: string;
+}
+export interface GroupAttributes {
+    email: string;
+    name: string;
+    description: string;
+    groupId: string;
+    /** Read-only — direct members, as a decimal string on the wire (Directory's own choice). */
+    directMembersCount: string;
+    /** Read-only. Aliases outside the primary domain/subdomains; edited only via alias endpoints. */
+    nonEditableAliases: string[];
+    /** Read-only. Aliases within the account's domains; edited only via alias endpoints. */
+    aliases: string[];
+    adminCreated: boolean;
+}
+export interface GoogleWorkspaceGroup extends Resource<'GoogleWorkspace.Group', GroupProps, GroupAttributes, never, GoogleWorkspaceRequirements> {
+}
+export declare const GoogleWorkspaceGroup: import("alchemy").ResourceClass<GoogleWorkspaceGroup>;
+/** ★ EXPORTED for direct testing with an explicit fake `Credentials` layer — see group.test.ts. */
+export declare const spec: GoogleWorkspaceSpec<GroupProps, directory.Group, GroupAttributes, directory.GetGroupsError | directory.InsertGroupsError | directory.PatchGroupsError | directory.DeleteGroupsError>;
+export declare const handlers: {
+    list: () => Effect.Effect<never[], never, never>;
+    read: ({ olds }: {
+        olds: GroupProps;
+    }) => Effect.Effect<GroupAttributes | undefined, import("@distilled.cloud/caddy").BadGateway | directory.BadRequest | directory.Conflict | directory.Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("@distilled.cloud/google-workspace/Errors").GoogleWorkspaceParseError | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | directory.NotFound | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/google-workspace/Errors").UnknownGoogleWorkspaceError, import("effect/unstable/http/HttpClient").HttpClient>;
+    diff: ({ news, output }: {
+        news: import("alchemy").Input<GroupProps>;
+        output: GroupAttributes | undefined;
+    }) => Effect.Effect<{
+        readonly action: 'update';
+    } | {
+        readonly action: 'noop';
+    } | {
+        readonly action: 'replace';
+    } | undefined, import("@distilled.cloud/caddy").BadGateway | directory.BadRequest | directory.Conflict | directory.Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("@distilled.cloud/google-workspace/Errors").GoogleWorkspaceParseError | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | directory.NotFound | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/google-workspace/Errors").UnknownGoogleWorkspaceError, import("effect/unstable/http/HttpClient").HttpClient>;
+    reconcile: ({ news }: {
+        news: GroupProps;
+    }) => Effect.Effect<GroupAttributes, import("@distilled.cloud/caddy").BadGateway | directory.BadRequest | directory.Conflict | directory.Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("@distilled.cloud/google-workspace/Errors").GoogleWorkspaceParseError | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | directory.NotFound | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/google-workspace/Errors").UnknownGoogleWorkspaceError, import("effect/unstable/http/HttpClient").HttpClient>;
+    delete: ({ olds }: {
+        olds: GroupProps;
+    }) => Effect.Effect<void, import("@distilled.cloud/caddy").BadGateway | directory.BadRequest | directory.Conflict | directory.Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("@distilled.cloud/google-workspace/Errors").GoogleWorkspaceParseError | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | directory.NotFound | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/google-workspace/Errors").UnknownGoogleWorkspaceError, import("effect/unstable/http/HttpClient").HttpClient>;
+};
+export declare const GoogleWorkspaceGroupProvider: () => import("effect/Layer").Layer<Provider.Provider<GoogleWorkspaceGroup>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=group.d.ts.map

package/dist/google-workspace/group.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"group.d.ts","sourceRoot":"","sources":["../../src/google-workspace/group.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,SAAS,MAAM,+DAA+D,CAAC;AAC3F,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAItF,MAAM,WAAW,UAAU;IACzB,uFAAuF;IACvF,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,4FAA4F;IAC5F,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iGAAiG;IACjG,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,wFAAwF;IACxF,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,oBAAqB,SAAQ,QAAQ,CACpD,uBAAuB,EACvB,UAAU,EACV,eAAe,EACf,KAAK,EACL,2BAA2B,CAC5B;CAAG;AAEJ,eAAO,MAAM,oBAAoB,uDAE/B,CAAC;AAoBH,mGAAmG;AACnG,eAAO,MAAM,IAAI,EAAE,mBAAmB,CACpC,UAAU,EACV,SAAS,CAAC,KAAK,EACf,eAAe,EACb,SAAS,CAAC,cAAc,GACxB,SAAS,CAAC,iBAAiB,GAC3B,SAAS,CAAC,gBAAgB,GAC1B,SAAS,CAAC,iBAAiB,CAqB9B,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;CAAgC,CAAC;AAEtD,eAAO,MAAM,4BAA4B,0IAC0D,CAAC"}

package/dist/google-workspace/index.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Google Workspace providers for Alchemy.
+ *
+ * ⛔ THIS BARREL IS THE PUBLIC API, AND IT IS DELIBERATELY SMALLER THAN THE DIRECTORY. These are
+ *   the symbols a real stack consumes; the rest of the files are internals a provider needs but a
+ *   consumer should not depend on. An `export *` here would publish every helper as API and make
+ *   the next refactor a breaking change.
+ * ★ `credentials.ts`'s re-exports ARE published, because a stack needs `CredentialsFromEnv` (or
+ *   `fromAccessToken` in a test) to build a runtime layer, and `GoogleWorkspaceKeyRef` /
+ *   `describeKeyRef` are the documentation seam credential setup is meant to go through.
+ */
+export { type GoogleWorkspaceConfig, Credentials, CredentialsFromEnv, describeKeyRef, fromAccessToken, GOOGLE_ACCESS_TOKEN_ENV, GOOGLE_PROJECT_ID_ENV, type GoogleWorkspaceKeyRef, } from './credentials.ts';
+export { GoogleWorkspaceDomainAlias, GoogleWorkspaceDomainAliasProvider, type DomainAliasAttributes, type DomainAliasProps, } from './domain-alias.ts';
+export { GoogleWorkspaceGroup, GoogleWorkspaceGroupProvider, type GroupAttributes, type GroupProps, } from './group.ts';
+export { GoogleWorkspaceGroupMember, GoogleWorkspaceGroupMemberProvider, type DeliverySettings, type GroupMemberAttributes, type GroupMemberProps, type MemberRole, } from './group-member.ts';
+export { GoogleWorkspaceOrgUnit, GoogleWorkspaceOrgUnitProvider, type OrgUnitAttributes, type OrgUnitProps, } from './org-unit.ts';
+export { googleWorkspaceProviders } from './providers.ts';
+export { googleWorkspaceHandlers, googleWorkspaceOperations, type GoogleWorkspaceRequirements, type GoogleWorkspaceSpec, } from './resource.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/google-workspace/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/google-workspace/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EACL,KAAK,qBAAqB,EAC1B,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,uBAAuB,EACvB,qBAAqB,EACrB,KAAK,qBAAqB,GAC3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,0BAA0B,EAC1B,kCAAkC,EAClC,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,KAAK,eAAe,EACpB,KAAK,UAAU,GAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,0BAA0B,EAC1B,kCAAkC,EAClC,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,UAAU,GAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,KAAK,iBAAiB,EACtB,KAAK,YAAY,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,KAAK,2BAA2B,EAChC,KAAK,mBAAmB,GACzB,MAAM,eAAe,CAAC"}

package/dist/google-workspace/index.js

@@ -0,0 +1,283 @@
+// src/google-workspace/credentials.ts
+import {
+  Credentials,
+  CredentialsFromEnv,
+  fromAccessToken
+} from "@distilled.cloud/google-workspace/Credentials";
+var GOOGLE_ACCESS_TOKEN_ENV = "GOOGLE_ACCESS_TOKEN";
+var GOOGLE_PROJECT_ID_ENV = "GOOGLE_PROJECT_ID";
+var KEY_SHAPED = /-----BEGIN|private_key|"type":\s*"service_account"/i;
+var describeKeyRef = (ref) => {
+  for (const [field, value] of Object.entries(ref)) {
+    const text = Array.isArray(value) ? value.join(",") : String(value);
+    if (KEY_SHAPED.test(text)) {
+      throw new Error(`GoogleWorkspaceKeyRef.${field} looks like key material, not a reference`);
+    }
+  }
+  return `service account at OpenBao:${ref.openBaoPath}, delegating as ${ref.delegatedAdmin}, ` + `scopes: ${ref.scopes.join(" ")}`;
+};
+// src/google-workspace/domain-alias.ts
+import { Resource } from "alchemy";
+import * as Provider from "alchemy/Provider";
+import * as directory from "@distilled.cloud/google-workspace/unstable/admin_directory_v1";
+import * as Effect2 from "effect/Effect";
+
+// src/google-workspace/resource.ts
+import { isResolved } from "alchemy/Diff";
+import { CredentialsFromEnv as CredentialsFromEnv2 } from "@distilled.cloud/google-workspace/Credentials";
+import * as Effect from "effect/Effect";
+var googleWorkspaceOperations = (spec) => {
+  const read = (props) => spec.fetchLive(props).pipe(Effect.map((live) => live === undefined ? undefined : spec.attributes(live, props)));
+  return {
+    read,
+    diff: (news, output) => Effect.gen(function* () {
+      if (output === undefined || !isResolved(news))
+        return;
+      const live = yield* read(news);
+      if (live === undefined)
+        return { action: "update" };
+      if (spec.matches(live, news))
+        return { action: "noop" };
+      return spec.update === undefined ? { action: "replace" } : { action: "update" };
+    }),
+    reconcile: (news) => Effect.gen(function* () {
+      const before = yield* spec.fetchLive(news);
+      if (before === undefined) {
+        if (spec.create === undefined) {
+          return yield* Effect.die(new Error(`${spec.describe(news)}: spec declares no create for a missing object`));
+        }
+        yield* spec.create(news);
+      } else if (spec.update !== undefined) {
+        const mapped = spec.attributes(before, news);
+        if (mapped !== undefined && !spec.matches(mapped, news)) {
+          yield* spec.update(news, before);
+        }
+      }
+      const after = yield* read(news);
+      if (after === undefined) {
+        return yield* Effect.die(new Error(`${spec.describe(news)}: the write returned no error but the object is still ` + "absent. Directory returns the object it wrote — read back rather than trusting " + "the status code."));
+      }
+      return after;
+    }),
+    destroy: (olds) => Effect.gen(function* () {
+      const live = yield* spec.fetchLive(olds);
+      if (live === undefined)
+        return;
+      yield* spec.destroy(olds, live);
+    })
+  };
+};
+var googleWorkspaceHandlers = (spec) => {
+  const ops = googleWorkspaceOperations(spec);
+  const withCredentials = (effect) => Effect.provide(effect, CredentialsFromEnv2);
+  return {
+    list: () => Effect.succeed([]),
+    read: ({ olds }) => withCredentials(ops.read(olds)),
+    diff: ({ news, output }) => withCredentials(ops.diff(news, output)),
+    reconcile: ({ news }) => withCredentials(ops.reconcile(news)),
+    delete: ({ olds }) => withCredentials(ops.destroy(olds))
+  };
+};
+
+// src/google-workspace/values.ts
+var text = (value) => value ?? "";
+var bool = (value) => value === true;
+var stringArray = (value) => value === undefined ? [] : [...value].toSorted();
+var ciEqual = (left, right) => left.toLowerCase() === right.toLowerCase();
+var stripLeadingSlash = (path) => path.replace(/^\/+/, "");
+var withLeadingSlash = (path) => path.startsWith("/") ? path : `/${path}`;
+
+// src/google-workspace/domain-alias.ts
+var GoogleWorkspaceDomainAlias = Resource("GoogleWorkspace.DomainAlias", { defaultRemovalPolicy: "retain" });
+var customerOf = (props) => props.customer ?? "my_customer";
+var attributesOf = (live, props) => {
+  if (live.domainAliasName === undefined || !ciEqual(live.domainAliasName, props.domainAliasName)) {
+    return;
+  }
+  return {
+    creationTime: text(live.creationTime),
+    customer: customerOf(props),
+    domainAliasName: live.domainAliasName,
+    parentDomainName: text(live.parentDomainName),
+    verified: bool(live.verified)
+  };
+};
+var spec = {
+  attributes: attributesOf,
+  create: (props) => directory.insertDomainAliases({
+    body: { domainAliasName: props.domainAliasName, parentDomainName: props.parentDomainName },
+    customer: customerOf(props)
+  }),
+  describe: (props) => `customer/${customerOf(props)}/domainaliases/${props.domainAliasName}`,
+  destroy: (props, live) => directory.deleteDomainAliases({
+    customer: customerOf(props),
+    domainAliasName: text(live.domainAliasName) || props.domainAliasName
+  }),
+  fetchLive: (props) => directory.getDomainAliases({ customer: customerOf(props), domainAliasName: props.domainAliasName }).pipe(Effect2.catchTag("NotFound", () => Effect2.succeed(undefined))),
+  matches: (attributes, props) => attributes.parentDomainName === props.parentDomainName
+};
+var handlers = googleWorkspaceHandlers(spec);
+var GoogleWorkspaceDomainAliasProvider = () => Provider.effect(GoogleWorkspaceDomainAlias, Effect2.succeed(GoogleWorkspaceDomainAlias.Provider.of(handlers)));
+// src/google-workspace/group.ts
+import { Resource as Resource2 } from "alchemy";
+import * as Provider2 from "alchemy/Provider";
+import * as directory2 from "@distilled.cloud/google-workspace/unstable/admin_directory_v1";
+import * as Effect3 from "effect/Effect";
+var GoogleWorkspaceGroup = Resource2("GoogleWorkspace.Group", {
+  defaultRemovalPolicy: "retain"
+});
+var defaultName = (props) => props.name ?? props.email.split("@")[0] ?? props.email;
+var attributesOf2 = (live, props) => {
+  if (live.email === undefined || !ciEqual(live.email, props.email))
+    return;
+  return {
+    adminCreated: live.adminCreated === true,
+    aliases: stringArray(live.aliases),
+    description: text(live.description),
+    directMembersCount: text(live.directMembersCount),
+    email: live.email,
+    groupId: text(live.id),
+    name: text(live.name),
+    nonEditableAliases: stringArray(live.nonEditableAliases)
+  };
+};
+var spec2 = {
+  attributes: attributesOf2,
+  create: (props) => directory2.insertGroups({
+    body: { description: props.description ?? "", email: props.email, name: defaultName(props) }
+  }),
+  describe: (props) => `groups/${props.email}`,
+  destroy: (_props, live) => directory2.deleteGroups({ groupKey: text(live.id) || text(live.email) }),
+  fetchLive: (props) => directory2.getGroups({ groupKey: props.email }).pipe(Effect3.catchTag("NotFound", () => Effect3.succeed(undefined))),
+  matches: (attributes, props) => attributes.description === (props.description ?? "") && attributes.name === defaultName(props),
+  update: (props, live) => directory2.patchGroups({
+    body: { description: props.description ?? "", name: defaultName(props) },
+    groupKey: text(live.id) || text(live.email)
+  })
+};
+var handlers2 = googleWorkspaceHandlers(spec2);
+var GoogleWorkspaceGroupProvider = () => Provider2.effect(GoogleWorkspaceGroup, Effect3.succeed(GoogleWorkspaceGroup.Provider.of(handlers2)));
+// src/google-workspace/group-member.ts
+import { Resource as Resource3 } from "alchemy";
+import * as Provider3 from "alchemy/Provider";
+import * as directory3 from "@distilled.cloud/google-workspace/unstable/admin_directory_v1";
+import * as Effect4 from "effect/Effect";
+var GoogleWorkspaceGroupMember = Resource3("GoogleWorkspace.GroupMember");
+var defaultRole = (props) => props.role ?? "MEMBER";
+var defaultDelivery = (props) => props.deliverySettings ?? "ALL_MAIL";
+var attributesOf3 = (live, props) => {
+  if (live.email === undefined || !ciEqual(live.email, props.email))
+    return;
+  return {
+    deliverySettings: text(live.delivery_settings),
+    email: live.email,
+    group: props.group,
+    memberId: text(live.id),
+    role: text(live.role),
+    status: text(live.status)
+  };
+};
+var spec3 = {
+  attributes: attributesOf3,
+  create: (props) => directory3.insertMembers({
+    body: {
+      delivery_settings: defaultDelivery(props),
+      email: props.email,
+      role: defaultRole(props)
+    },
+    groupKey: props.group
+  }),
+  describe: (props) => `groups/${props.group}/members/${props.email}`,
+  destroy: (props, live) => directory3.deleteMembers({ groupKey: props.group, memberKey: text(live.id) || props.email }),
+  fetchLive: (props) => directory3.getMembers({ groupKey: props.group, memberKey: props.email }).pipe(Effect4.catchTag("NotFound", () => Effect4.succeed(undefined))),
+  matches: (attributes, props) => attributes.role === defaultRole(props) && attributes.deliverySettings === defaultDelivery(props),
+  update: (props, live) => directory3.patchMembers({
+    body: { delivery_settings: defaultDelivery(props), role: defaultRole(props) },
+    groupKey: props.group,
+    memberKey: text(live.id) || props.email
+  })
+};
+var handlers3 = googleWorkspaceHandlers(spec3);
+var GoogleWorkspaceGroupMemberProvider = () => Provider3.effect(GoogleWorkspaceGroupMember, Effect4.succeed(GoogleWorkspaceGroupMember.Provider.of(handlers3)));
+// src/google-workspace/org-unit.ts
+import { Resource as Resource4 } from "alchemy";
+import * as Provider4 from "alchemy/Provider";
+import * as directory4 from "@distilled.cloud/google-workspace/unstable/admin_directory_v1";
+import * as Effect5 from "effect/Effect";
+var GoogleWorkspaceOrgUnit = Resource4("GoogleWorkspace.OrgUnit", {
+  defaultRemovalPolicy: "retain"
+});
+var customerOf2 = (props) => props.customerId ?? "my_customer";
+var nameOf = (props) => props.orgUnitPath.split("/").filter(Boolean).pop() ?? props.orgUnitPath;
+var parentOf = (props) => props.parentOrgUnitPath ?? "/";
+var attributesOf4 = (live, props) => {
+  const livePath = live.orgUnitPath === undefined ? undefined : withLeadingSlash(live.orgUnitPath);
+  if (livePath === undefined || livePath.toLowerCase() !== props.orgUnitPath.toLowerCase()) {
+    return;
+  }
+  return {
+    customerId: customerOf2(props),
+    description: text(live.description),
+    name: text(live.name),
+    orgUnitId: text(live.orgUnitId),
+    orgUnitPath: livePath,
+    parentOrgUnitPath: text(live.parentOrgUnitPath)
+  };
+};
+var spec4 = {
+  attributes: attributesOf4,
+  create: (props) => directory4.insertOrgunits({
+    body: {
+      description: props.description ?? "",
+      name: nameOf(props),
+      parentOrgUnitPath: parentOf(props)
+    },
+    customerId: customerOf2(props)
+  }),
+  describe: (props) => `customer/${customerOf2(props)}/orgunits${props.orgUnitPath}`,
+  destroy: (props, live) => directory4.deleteOrgunits({
+    customerId: customerOf2(props),
+    orgUnitPath: stripLeadingSlash(text(live.orgUnitPath) || props.orgUnitPath)
+  }),
+  fetchLive: (props) => directory4.getOrgunits({
+    customerId: customerOf2(props),
+    orgUnitPath: stripLeadingSlash(props.orgUnitPath)
+  }).pipe(Effect5.catchTag("NotFound", () => Effect5.succeed(undefined))),
+  matches: (attributes, props) => attributes.description === (props.description ?? "") && attributes.parentOrgUnitPath === parentOf(props) && attributes.name === nameOf(props),
+  update: (props, live) => directory4.patchOrgunits({
+    body: {
+      description: props.description ?? "",
+      name: nameOf(props),
+      parentOrgUnitPath: parentOf(props)
+    },
+    customerId: customerOf2(props),
+    orgUnitPath: stripLeadingSlash(text(live.orgUnitPath) || props.orgUnitPath)
+  })
+};
+var handlers4 = googleWorkspaceHandlers(spec4);
+var GoogleWorkspaceOrgUnitProvider = () => Provider4.effect(GoogleWorkspaceOrgUnit, Effect5.succeed(GoogleWorkspaceOrgUnit.Provider.of(handlers4)));
+// src/google-workspace/providers.ts
+import * as Layer from "effect/Layer";
+var googleWorkspaceProviders = () => Layer.mergeAll(GoogleWorkspaceGroupProvider(), GoogleWorkspaceGroupMemberProvider(), GoogleWorkspaceDomainAliasProvider(), GoogleWorkspaceOrgUnitProvider());
+export {
+  Credentials,
+  CredentialsFromEnv,
+  GOOGLE_ACCESS_TOKEN_ENV,
+  GOOGLE_PROJECT_ID_ENV,
+  GoogleWorkspaceDomainAlias,
+  GoogleWorkspaceDomainAliasProvider,
+  GoogleWorkspaceGroup,
+  GoogleWorkspaceGroupMember,
+  GoogleWorkspaceGroupMemberProvider,
+  GoogleWorkspaceGroupProvider,
+  GoogleWorkspaceOrgUnit,
+  GoogleWorkspaceOrgUnitProvider,
+  describeKeyRef,
+  fromAccessToken,
+  googleWorkspaceHandlers,
+  googleWorkspaceOperations,
+  googleWorkspaceProviders
+};
+
+//# debugId=B08C209C914E559B64756E2164756E21
+//# sourceMappingURL=index.js.map